@cosmicdrift/kumiko-bundled-features 0.387.0 → 0.388.0

package/dist/template-resolver/handlers/tenant-overrides.query.js

@@ -1,5 +1,5 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/db";
-import { defineQueryHandler, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
+import { defineQueryHandler, MAX_LIST_LIMIT, SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { TenantQueries } from "../../tenant/index.js";
 import { templateResourcesTable } from "../table.js";
@@ -10,8 +10,31 @@ import { loadEnabledTenantIds, pickBestRowPerTenant, TENANT_OVERRIDES_REASON, }
 const directorySchema = z.object({
     rows: z.array(z.object({ id: z.string(), label: z.string() })),
 });
-function labelsOf(raw) {
-    return new Map(directorySchema.parse(raw).rows.map((row) => [row.id, row.label]));
+function chunksOf(items, size) {
+    const chunks = [];
+    for (let start = 0; start < items.length; start += size) {
+        chunks.push(items.slice(start, start + size));
+    }
+    return chunks;
+}
+// Looks up only the ids the overrides need, so labels never depend on the directory's default cap.
+async function labelsFor(ctx, queryName, ids) {
+    const labels = new Map();
+    for (const chunk of chunksOf([...ids], MAX_LIST_LIMIT)) {
+        const raw = await ctx.query(queryName, { ids: chunk });
+        for (const row of directorySchema.parse(raw).rows)
+            labels.set(row.id, row.label);
+    }
+    return labels;
+}
+function changerIdsOf(rows) {
+    const ids = new Set();
+    for (const row of rows) {
+        const changedById = row.modifiedById ?? row.insertedById;
+        if (changedById !== null)
+            ids.add(changedById);
+    }
+    return ids;
 }
 function statusOf(row) {
     return row.status === "active" ? "active" : "draft";
@@ -55,10 +78,10 @@ export const tenantOverridesQuery = defineQueryHandler({
         const bestByTenant = pickBestRowPerTenant(found, enabledTenantIds);
         const best = [...bestByTenant.values()];
         const tenantLabels = hasTenantFeature
-            ? labelsOf(await ctx.query(TenantQueries.tenantDirectory, {}))
+            ? await labelsFor(ctx, TenantQueries.tenantDirectory, new Set(best.map((row) => row.tenantId)))
             : new Map();
         const userLabels = hasTenantFeature
-            ? labelsOf(await ctx.query(TenantQueries.memberDirectory, {}))
+            ? await labelsFor(ctx, TenantQueries.memberDirectory, changerIdsOf(best))
             : new Map();
         const rows = best
             .map((row) => toOverrideRow(row, tenantLabels, userLabels))

package/dist/template-resolver/handlers/usage.query.d.ts

@@ -1,5 +1,6 @@
 import * as z from "zod";
-export declare const usageQuery: import("@cosmicdrift/kumiko-types/define-handler").QueryHandlerDefinition<"usage", z.ZodObject<{
+import type { TemplateEditPolicy } from "../template-edit-policy.ts";
+export declare function makeUsageQuery(policy: TemplateEditPolicy): import("@cosmicdrift/kumiko-types/define-handler").QueryHandlerDefinition<"usage", z.ZodObject<{
     slug: z.ZodString;
     kind: z.ZodEnum<{
         "ai-prompt": "ai-prompt";

package/dist/template-resolver/handlers/usage.query.js

@@ -6,20 +6,30 @@ import { deliveryPolicyOf } from "../template-delivery-policy.js";
 import { templateSlugSchema } from "../template-meta.js";
 import { collectTemplateUsage } from "../template-usage.js";
 import { TEMPLATE_KINDS } from "../web/constants.js";
-import { effectiveMailLayoutSlugs } from "./overview.query.js";
+import { effectiveMailLayoutSlugs, isRowVisibleToCaller } from "./overview.query.js";
 const MAIL_ROW_LIMIT = 5000;
-export const usageQuery = defineQueryHandler({
-    name: "usage",
-    schema: z.object({ slug: templateSlugSchema, kind: z.enum(TEMPLATE_KINDS) }),
-    access: { roles: ["TenantAdmin", "SystemAdmin"] },
-    description: "Lists the code-registered notifications that use one template: a mail template is used by the notification whose qualified name is its slug and that has a code template, a mail layout by every mail notification whose effective template (own override, else system) names it, or whose code meta does when no stored template exists, or that falls back to the default layout; use it to show what a change to a template affects.",
-    handler: async (query, ctx) => {
-        const { slug, kind } = query.payload;
-        if (kind !== "mail-layout")
-            return { usedBy: collectTemplateUsage(ctx.registry, slug, kind) };
-        const mailRows = await selectMany(ctx.db, templateResourcesTable, { kind: "mail" }, { limit: MAIL_ROW_LIMIT });
-        return {
-            usedBy: collectTemplateUsage(ctx.registry, slug, kind, effectiveMailLayoutSlugs(mailRows, deliveryPolicyOf(ctx.registry))),
-        };
-    },
-});
+export function makeUsageQuery(policy) {
+    return defineQueryHandler({
+        name: "usage",
+        schema: z.object({ slug: templateSlugSchema, kind: z.enum(TEMPLATE_KINDS) }),
+        access: { roles: ["TenantAdmin", "SystemAdmin"] },
+        description: "Lists the code-registered notifications that use one template: a mail template is used by the notification whose qualified name is its slug and that has a code template, a mail layout by every mail notification whose effective template (own override, else system) names it, or whose code meta does when no stored template exists, or that falls back to the default layout; use it to show what a change to a template affects.",
+        handler: async (query, ctx) => {
+            const { slug, kind } = query.payload;
+            if (kind !== "mail-layout")
+                return { usedBy: collectTemplateUsage(ctx.registry, slug, kind) };
+            const fetchedRows = await selectMany(ctx.db, templateResourcesTable, { kind: "mail" }, { orderBy: { col: "id", direction: "asc" }, limit: MAIL_ROW_LIMIT + 1 });
+            if (fetchedRows.length > MAIL_ROW_LIMIT) {
+                ctx.log?.warn("template usage: row limit reached, result is incomplete", {
+                    limit: MAIL_ROW_LIMIT,
+                });
+            }
+            const visibleRows = fetchedRows
+                .slice(0, MAIL_ROW_LIMIT)
+                .filter((row) => isRowVisibleToCaller(policy, query.user, ctx.registry, row));
+            return {
+                usedBy: collectTemplateUsage(ctx.registry, slug, kind, effectiveMailLayoutSlugs(visibleRows, deliveryPolicyOf(ctx.registry))),
+            };
+        },
+    });
+}

package/dist/template-resolver/handlers/validate.query.js

@@ -1,9 +1,10 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler, SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
+import { isRowDeliveredTo } from "../api.js";
 import { imageResourceKeysOf } from "../linked-resources.js";
 import { templateResourcesTable } from "../table.js";
-import { deliveryPolicyOf, isRowServedTo } from "../template-delivery-policy.js";
+import { deliveryPolicyOf } from "../template-delivery-policy.js";
 import { isSystemAdmin } from "../template-draft.js";
 import { resolveTemplateVariables, systemPlaceholdersFor } from "../template-validation.js";
 import { contentFormatSchema, kindSchema, localeSchema, templateSlugSchema } from "./shared.js";
@@ -31,7 +32,11 @@ export async function knownResourceKeysFor(ctx, user, where) {
             locale,
         })),
         ...(scope === "tenant" &&
-            isRowServedTo(deliveryPolicyOf(ctx.registry), user, { tenantId: user.tenantId, kind, slug })
+            (await isRowDeliveredTo(ctx.db, deliveryPolicyOf(ctx.registry), user, {
+                tenantId: user.tenantId,
+                kind,
+                slug,
+            }))
             ? await knownResourceKeys(ctx.db, { tenantId: user.tenantId, slug, kind, scope, locale })
             : []),
     ];

package/dist/template-resolver/seeding.js

@@ -39,10 +39,16 @@ async function resolveExistingForEventStoreSeed(db, tdb, existingRow, tenantId)
     }
     return { id, version: streamVersion };
 }
+// Namespace prefix plus path, no whitespace: keeps free text from passing as a key that the UI
+// would then show raw.
+const I18N_KEY_FORMAT = /^[^\s:]+:\S+$/;
 function seedTitleColumn(opts, label) {
     if (opts.title !== undefined && opts.titleI18nKey !== undefined) {
         throw new Error(`${label} rejected: set either title or titleI18nKey, not both`);
     }
+    if (opts.titleI18nKey !== undefined && !I18N_KEY_FORMAT.test(opts.titleI18nKey)) {
+        throw new Error(`${label} rejected: titleI18nKey "${opts.titleI18nKey}" is not a "namespace:key" i18n key`);
+    }
     return opts.titleI18nKey ?? opts.title ?? null;
 }
 export async function seedSystemTemplate(db, opts) {
@@ -101,16 +107,18 @@ export async function seedSystemTemplate(db, opts) {
             current?.title === rowFields.title &&
             current?.variableSchema === rowFields.variableSchema &&
             current?.meta === rowFields.meta &&
-            current?.status === rowFields.status &&
             current?.parentTemplateId === rowFields.parentTemplateId &&
             (linkedResources === undefined || current?.linkedResources === linkedResources)) {
             return { id: String(row.id) };
         }
-        const result = await executor.update({
-            id: row.id,
-            version: row.version,
-            changes: { ...rowFields, ...activeStampChanges(row) },
-        }, by, tdb);
+        // An archived system row is a SystemAdmin decision (reversible with publish-system) that a
+        // pod-boot re-seed must not undo; content still follows the code. The seed replaces the
+        // content, so an open draft on the old content is dropped with it.
+        const { status: _status, ...contentFields } = rowFields;
+        const changes = current?.status === "archived"
+            ? { ...contentFields, status: "archived", draft: null }
+            : { ...rowFields, ...activeStampChanges(row), draft: null };
+        const result = await executor.update({ id: row.id, version: row.version, changes }, by, tdb);
         if (!result.isSuccess) {
             throw new Error(`seedSystemTemplate update failed: ${JSON.stringify(result)}`);
         }
@@ -191,8 +199,10 @@ async function seedSystemTemplateBundleWithResources(db, bundle, opts) {
     if (!dispatcher) {
         throw new Error(`${label}: bundles with resources need a file provider; pass opts.dispatcher (the dispatcher of the seed deps) so the files are stored through the import-bundle-system write`);
     }
-    if ((opts.ifExists ?? "skip") === "skip") {
-        const existingIds = {};
+    const skipExisting = (opts.ifExists ?? "skip") === "skip";
+    const existingIds = {};
+    let bundleToImport = bundle;
+    if (skipExisting) {
         for (const locale of Object.keys(bundle.locales)) {
             const row = await fetchOne(db, templateResourcesTable, {
                 tenantId: SYSTEM_TENANT_ID,
@@ -206,12 +216,18 @@ async function seedSystemTemplateBundleWithResources(db, bundle, opts) {
         if (Object.keys(existingIds).length === Object.keys(bundle.locales).length) {
             return { ids: existingIds };
         }
+        // import-bundle-system always overwrites, so only the missing locales go in: a
+        // hand-edited system row of an already seeded locale must survive the new-locale boot.
+        bundleToImport = {
+            ...bundle,
+            locales: Object.fromEntries(Object.entries(bundle.locales).filter(([locale]) => !(locale in existingIds))),
+        };
     }
-    const result = await dispatcher.write(TemplateResolverHandlers.importBundleSystem, { bundle }, opts.by ?? createSystemUser(SYSTEM_TENANT_ID, ["SystemAdmin"]));
+    const result = await dispatcher.write(TemplateResolverHandlers.importBundleSystem, { bundle: bundleToImport }, opts.by ?? createSystemUser(SYSTEM_TENANT_ID, ["SystemAdmin"]));
     if (!result.isSuccess) {
         throw new Error(`${label} failed: ${result.error.code}: ${result.error.message}`);
     }
-    return { ids: importedIds(result.data) };
+    return { ids: { ...existingIds, ...importedIds(result.data) } };
 }
 function importedIds(data) {
     const ids = isPlainObject(data) ? data["ids"] : undefined;

package/dist/template-resolver/store-template-resource.d.ts

@@ -42,6 +42,7 @@ export declare function prepareTemplateResourceBeforeTransaction(args: {
 }): Promise<BeforeTransactionResult<PreparedTemplateImage>>;
 export type Release = () => Promise<void>;
 export declare function releaseAll(releases: readonly Release[]): Promise<void>;
+export declare function releaseAfterFailure(ctx: HandlerContext, releases: readonly Release[]): Promise<void>;
 export type PreparedLinkedResourceCopy = {
     readonly key: string;
     readonly entry: LinkedResourceEntry;

package/dist/template-resolver/store-template-resource.js

@@ -24,6 +24,9 @@ function keyInUse() {
         details: { code: "key_in_use" },
     }));
 }
+function isImageKey(links, key) {
+    return typeof links[key] === "string";
+}
 function isAttachmentKey(links, key) {
     const occupant = links[key];
     return occupant !== undefined && typeof occupant !== "string";
@@ -129,6 +132,17 @@ export async function releaseAll(releases) {
     if (rejected?.status === "rejected")
         throw rejected.reason;
 }
+// Failure paths: a failing release must not replace the upload error the caller needs to see.
+export async function releaseAfterFailure(ctx, releases) {
+    try {
+        await releaseAll(releases);
+    }
+    catch (releaseError) {
+        ctx.log?.warn("template upload rollback: releasing stored files failed", {
+            error: releaseError instanceof Error ? releaseError.message : String(releaseError),
+        });
+    }
+}
 // beforeTransaction half: copies the file behind every entry into the target tenant's storage, so a
 // template copied from the system default keeps working once the tenant exports it or measures its
 // attachments. An entry whose source file is gone is left out: it could not be resolved at render
@@ -148,7 +162,7 @@ export async function prepareLinkedResourceCopiesBeforeTransaction(args) {
                 continue;
             const uploaded = await uploadToTenant({ ctx, user, tenantId }, { fileName: file.fileName, mimeType: file.contentType, data: file.bytes });
             if (!uploaded.isSuccess) {
-                await releaseAll(releases);
+                await releaseAfterFailure(ctx, releases);
                 return uploaded;
             }
             if (uploaded.release)
@@ -157,7 +171,7 @@ export async function prepareLinkedResourceCopiesBeforeTransaction(args) {
         }
     }
     catch (cause) {
-        await releaseAll(releases);
+        await releaseAfterFailure(ctx, releases);
         throw cause;
     }
     return { isSuccess: true, data: copies, release: () => releaseAll(releases) };
@@ -275,8 +289,7 @@ async function checkAttachmentTarget(args) {
     if (otherAttachmentCount(linked, key) >= MAX_FILE_ATTACHMENTS_PER_TEMPLATE) {
         return attachmentLimitFailure();
     }
-    const occupant = linked[key];
-    if (occupant !== undefined && typeof occupant === "string")
+    if (isImageKey(linked, key))
         return keyInUse();
     return { isSuccess: true, data: { row, linked } };
 }
@@ -387,6 +400,8 @@ export async function linkTemplatePdfAttachment(args) {
     if (row.kind !== "mail")
         return attachmentNeedsMailTemplate();
     const linked = parseLinkedResourceEntries(row.linkedResources);
+    if (isImageKey(linked, key))
+        return keyInUse();
     if (otherAttachmentCount(linked, key) >= MAX_FILE_ATTACHMENTS_PER_TEMPLATE) {
         return attachmentLimitFailure();
     }

package/dist/template-resolver/template-delivery-policy.d.ts

@@ -13,10 +13,5 @@ export declare function isServedByCollectionOnly(policy: TemplateDeliveryPolicy,
 export declare function isRowServed(policy: TemplateDeliveryPolicy, row: DeliveryTarget & {
     readonly tenantId: string;
 }): boolean;
-export declare function isRowServedTo(policy: TemplateDeliveryPolicy, user: {
-    readonly roles: readonly string[];
-}, row: DeliveryTarget & {
-    readonly tenantId: string;
-}): boolean;
 export declare function deliveryPolicyOf(registry: Registry): TemplateDeliveryPolicy;
 export {};

package/dist/template-resolver/template-delivery-policy.js

@@ -1,5 +1,4 @@
 import { isPlainObject, propertyOf } from "@cosmicdrift/kumiko-types/type-guards";
-import { isSystemAdmin } from "./template-draft.js";
 import { SYSTEM_TENANT_ID } from "./web/constants.js";
 import { TEMPLATE_RESOLVER_FEATURE } from "./web/qualified-names.js";
 const NOTHING_UNLOCKED = { tenantEditable: [], collectionKinds: [] };
@@ -16,11 +15,6 @@ export function isServedByCollectionOnly(policy, target) {
 export function isRowServed(policy, row) {
     return row.tenantId === SYSTEM_TENANT_ID || isTenantOverrideServed(policy, row);
 }
-// A SystemAdmin sees every stored row, so a locked override can still be reset; everyone else
-// sees only what is delivered, which keeps a locked override out of the template-resolver queries for a TenantAdmin (the audit log keeps the history).
-export function isRowServedTo(policy, user, row) {
-    return isSystemAdmin(user) || isRowServed(policy, row);
-}
 function isDeliveryTarget(value) {
     return (typeof propertyOf(value, "kind") === "string" && typeof propertyOf(value, "slug") === "string");
 }

package/dist/template-resolver/template-meta.js

@@ -1,6 +1,7 @@
 import * as z from "zod";
 import { HEX_COLOR_PATTERN, PDF_ORIENTATIONS, PDF_PAGE_FORMATS, } from "./web/constants.js";
 import { MAIL_TONES } from "./web/mail-constants.js";
+import { MAIL_LAYOUT_ACCENT_LINES, MAIL_LAYOUT_BUTTON_STYLES, MAIL_LAYOUT_FONTS, MAIL_LAYOUT_WIDTHS, } from "./web/mail-layout-constants.js";
 // One or more kebab segments joined by ":" — notification templates are seeded
 // under their qualified name `feature:notify:name`.
 export const templateSlugSchema = z
@@ -66,12 +67,14 @@ const pdfMetaSchema = z
         .optional(),
 })
     .strict();
-const MAIL_LAYOUT_FONTS = ["sans", "serif"];
-const MAIL_LAYOUT_ACCENT_LINES = ["branding", "none"];
-const MAIL_LAYOUT_BUTTON_STYLES = ["filled-rounded", "filled-square", "outline"];
+const MAIL_LAYOUT_WIDTH_LITERALS = [
+    z.literal(MAIL_LAYOUT_WIDTHS[0]),
+    z.literal(MAIL_LAYOUT_WIDTHS[1]),
+    z.literal(MAIL_LAYOUT_WIDTHS[2]),
+];
 const mailLayoutMetaSchema = z
     .object({
-    width: z.union([z.literal(560), z.literal(600), z.literal(640)]).optional(),
+    width: z.union(MAIL_LAYOUT_WIDTH_LITERALS).optional(),
     font: z.enum(MAIL_LAYOUT_FONTS).optional(),
     outerBackground: z.string().regex(HEX_COLOR_PATTERN, "must be a #rrggbb color").optional(),
     accentLine: z.enum(MAIL_LAYOUT_ACCENT_LINES).optional(),

package/dist/template-resolver/template-preview.js

@@ -8,7 +8,7 @@ import * as z from "zod";
 import { createEmailAttachmentReader, createTemplateMailRenderer } from "../delivery/index.js";
 import { fileContextForTenant } from "../file-foundation/index.js";
 import { collectRendererPlugins, createRendererFoundationApi, RendererError, } from "../renderer-foundation/index.js";
-import { createTemplateResolverApi, TemplateNotFoundError } from "./api.js";
+import { createTemplateResolverApi, isRowDeliveredTo, TemplateNotFoundError, } from "./api.js";
 import { collectDocumentResourceKeys } from "./compile-document-body.js";
 import { parseStoredJson } from "./handlers/template-gates.js";
 import { validateTemplateDraft } from "./handlers/validate.query.js";
@@ -16,7 +16,7 @@ import { readLayoutRegions, sanitizeLayoutHtml, } from "./layout-regions.js";
 import { parseLinkedResourceEntries } from "./linked-resources.js";
 import { buildDisplayHtml } from "./preview-display-html.js";
 import { templateResourcesTable } from "./table.js";
-import { deliveryPolicyOf, isRowServedTo } from "./template-delivery-policy.js";
+import { deliveryPolicyOf } from "./template-delivery-policy.js";
 import { isMailTemplateMeta, parseTemplateMeta, readPdfTemplateMeta, } from "./template-meta.js";
 import { DEFAULT_MAIL_LAYOUT_SLUG, DEFAULT_PDF_LAYOUT_SLUG, MAIL_PREVIEW_MAX_BYTES, SYSTEM_TENANT_ID, } from "./web/constants.js";
 import { TemplateResolverErrors } from "./web/qualified-names.js";
@@ -149,7 +149,8 @@ export function estimateMailBytes(args) {
 async function loadEditedRowResources(ctx, user, input) {
     const rows = await selectMany(ctx.db, templateResourcesTable, { tenantId: user.tenantId, slug: input.slug, kind: "mail", locale: input.locale }, { limit: 1 });
     const row = rows[0];
-    if (row !== undefined && !isRowServedTo(deliveryPolicyOf(ctx.registry), user, row)) {
+    if (row !== undefined &&
+        !(await isRowDeliveredTo(ctx.db, deliveryPolicyOf(ctx.registry), user, row))) {
         return undefined;
     }
     return row === undefined ? undefined : parseLinkedResourceEntries(row.linkedResources);

package/dist/template-resolver/web/constants.d.ts

@@ -10,7 +10,7 @@ export declare const UPSERT_KINDS: readonly ["mail", "document-pdf", "image-snap
 export type UpsertKind = (typeof UPSERT_KINDS)[number];
 export declare const TEXT_BLOCK_KIND: "text-block";
 export declare const COLLECTION_REFUSED_KINDS: readonly ["mail", "mail-layout", "pdf-layout"];
-export declare function isCollectionRefusedKind(kind: string): boolean;
+export declare function isCollectionRefusedKind(kind: unknown): kind is (typeof COLLECTION_REFUSED_KINDS)[number];
 export declare const CONTENT_FORMATS: readonly ["markdown", "mjml", "html", "plain"];
 export type ContentFormat = (typeof CONTENT_FORMATS)[number];
 export declare const TEMPLATE_SCOPES: readonly ["system", "tenant"];
@@ -18,8 +18,8 @@ export type TemplateScope = (typeof TEMPLATE_SCOPES)[number];
 export declare const TEMPLATE_STATUSES: readonly ["draft", "active", "archived"];
 export type TemplateStatus = (typeof TEMPLATE_STATUSES)[number];
 export declare const ACTIVE_TEMPLATE_STATUS = "active";
+export { HEX_COLOR_PATTERN } from "./mail-layout-constants.ts";
 export { PDF_DEFAULT_MARGIN_MM, PDF_FOOTER_MARGIN_MM, PDF_HEADER_MARGIN_MM, PDF_ORIENTATIONS, PDF_PAGE_FORMATS, type PdfOrientation, type PdfPageFormat, } from "./pdf-constants.ts";
-export declare const HEX_COLOR_PATTERN: RegExp;
 export declare const DEFAULT_MAIL_LAYOUT_SLUG = "default";
 export declare const DEFAULT_PDF_LAYOUT_SLUG = "default";
 export declare const MAIL_PREVIEW_MAX_BYTES: number;

package/dist/template-resolver/web/constants.js

@@ -4,6 +4,7 @@
 // RenderKind identifies the consumer class of a template. Plugin renderers in
 // `renderer-foundation` match on kind; the resolver here is kind-agnostic: it
 // only loads, and the content format (markdown/mjml/html) decides who renders it.
+import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
 export const RENDER_KINDS = ["mail", "document-pdf", "image-snapshot"];
 // Kinds whose html body is a rich document: the server rebuilds it through the
 // document schema on every write (see document-sanitizer.ts).
@@ -44,15 +45,14 @@ export const COLLECTION_REFUSED_KINDS = [
     "pdf-layout",
 ];
 export function isCollectionRefusedKind(kind) {
-    return COLLECTION_REFUSED_KINDS.some((refused) => refused === kind);
+    return isOneOf(COLLECTION_REFUSED_KINDS, kind);
 }
 export const CONTENT_FORMATS = ["markdown", "mjml", "html", "plain"];
 export const TEMPLATE_SCOPES = ["system", "tenant"];
 export const TEMPLATE_STATUSES = ["draft", "active", "archived"];
 export const ACTIVE_TEMPLATE_STATUS = "active";
+export { HEX_COLOR_PATTERN } from "./mail-layout-constants.js";
 export { PDF_DEFAULT_MARGIN_MM, PDF_FOOTER_MARGIN_MM, PDF_HEADER_MARGIN_MM, PDF_ORIENTATIONS, PDF_PAGE_FORMATS, } from "./pdf-constants.js";
-// Colors end up inside MJML attributes, so only a strict hex is ever written there.
-export const HEX_COLOR_PATTERN = /^#[0-9a-fA-F]{6}$/;
 export const DEFAULT_MAIL_LAYOUT_SLUG = "default";
 export const DEFAULT_PDF_LAYOUT_SLUG = "default";
 // The mail transport enforces no size limit of its own; 10 MiB is a common provider ceiling.

package/dist/template-resolver/web/index.d.ts

@@ -2,6 +2,7 @@ export { textBlocksClient } from "./client-plugin.tsx";
 export { DocumentContentEditor } from "./document-editor.tsx";
 export { type DocumentEditorChrome, type DocumentEditorHandle, type DocumentEditorProps, type DocumentResourcePreview, type DocumentToolbarBlock, MAIL_DOCUMENT_BLOCKS, PDF_DOCUMENT_BLOCKS, } from "./document-toolbar-blocks.ts";
 export { MAIL_TONES, type MailTone } from "./mail-constants.ts";
+export { HEX_COLOR_PATTERN, MAIL_LAYOUT_ACCENT_LINES, MAIL_LAYOUT_BUTTON_STYLES, MAIL_LAYOUT_FONTS, MAIL_LAYOUT_WIDTHS, } from "./mail-layout-constants.ts";
 export { PDF_DEFAULT_MARGIN_MM, PDF_FOOTER_MARGIN_MM, PDF_HEADER_MARGIN_MM, PDF_ORIENTATIONS, PDF_PAGE_FORMATS, } from "./pdf-constants.ts";
 export { PlaceholderLineEditor, type PlaceholderLineEditorProps, } from "./placeholder-line-editor-lazy.tsx";
 export { TemplateResolverErrors, TemplateResolverHandlers, TemplateResolverQueries, } from "./qualified-names.ts";

package/dist/template-resolver/web/index.js

@@ -7,6 +7,7 @@ export { textBlocksClient } from "./client-plugin.js";
 export { DocumentContentEditor } from "./document-editor.js";
 export { MAIL_DOCUMENT_BLOCKS, PDF_DOCUMENT_BLOCKS, } from "./document-toolbar-blocks.js";
 export { MAIL_TONES } from "./mail-constants.js";
+export { HEX_COLOR_PATTERN, MAIL_LAYOUT_ACCENT_LINES, MAIL_LAYOUT_BUTTON_STYLES, MAIL_LAYOUT_FONTS, MAIL_LAYOUT_WIDTHS, } from "./mail-layout-constants.js";
 export { PDF_DEFAULT_MARGIN_MM, PDF_FOOTER_MARGIN_MM, PDF_HEADER_MARGIN_MM, PDF_ORIENTATIONS, PDF_PAGE_FORMATS, } from "./pdf-constants.js";
 export { PlaceholderLineEditor, } from "./placeholder-line-editor-lazy.js";
 export { TemplateResolverErrors, TemplateResolverHandlers, TemplateResolverQueries, } from "./qualified-names.js";

package/dist/template-resolver/web/mail-layout-constants.d.ts

@@ -0,0 +1,5 @@
+export declare const MAIL_LAYOUT_WIDTHS: readonly [560, 600, 640];
+export declare const MAIL_LAYOUT_FONTS: readonly ["sans", "serif"];
+export declare const MAIL_LAYOUT_ACCENT_LINES: readonly ["branding", "none"];
+export declare const MAIL_LAYOUT_BUTTON_STYLES: readonly ["filled-rounded", "filled-square", "outline"];
+export declare const HEX_COLOR_PATTERN: RegExp;

package/dist/template-resolver/web/mail-layout-constants.js

@@ -0,0 +1,7 @@
+// No imports: web/ re-exports these, and template-meta.ts pulls in zod and the framework engine.
+export const MAIL_LAYOUT_WIDTHS = [560, 600, 640];
+export const MAIL_LAYOUT_FONTS = ["sans", "serif"];
+export const MAIL_LAYOUT_ACCENT_LINES = ["branding", "none"];
+export const MAIL_LAYOUT_BUTTON_STYLES = ["filled-rounded", "filled-square", "outline"];
+// Colors end up inside MJML attributes, so only a strict hex is ever written there.
+export const HEX_COLOR_PATTERN = /^#[0-9a-fA-F]{6}$/;

package/dist/tenant/handlers/member-directory.query.d.ts

@@ -2,6 +2,7 @@ import * as z from "zod";
 export declare const memberDirectoryQuery: import("@cosmicdrift/kumiko-framework/engine").PagedQueryHandlerDefinition<"memberDirectory", z.ZodObject<{
     limit: z.ZodDefault<z.ZodNumber>;
     search: z.ZodOptional<z.ZodString>;
+    ids: z.ZodOptional<z.ZodArray<z.ZodString>>;
 }, z.core.$strip>, {
     id: string;
     label: string;

package/dist/tenant/handlers/member-directory.query.js

@@ -40,6 +40,8 @@ export const memberDirectoryQuery = definePagedQueryHandler({
         limit: z.number().int().min(1).max(MAX_LIST_LIMIT).default(MAX_LIST_LIMIT),
         // Sent by the reference combobox while the user types.
         search: z.string().trim().min(1).optional(),
+        // Resolves exactly these users; callers that know their ids must not depend on the cap.
+        ids: z.array(z.string().min(1)).max(MAX_LIST_LIMIT).optional(),
     }),
     access: { roles: access.admin },
     description: "Lists users as id/label pairs for resolving user references to display names: the caller's own tenant members for an admin, every user for a SystemAdmin; carries no email or role data.",
@@ -50,21 +52,26 @@ export const memberDirectoryQuery = definePagedQueryHandler({
                 message: "tenant:query:member-directory requires ctx.systemDb — is r.systemScope() still set on the tenant feature?",
             });
         }
-        const { limit, search } = query.payload;
+        const { limit, search, ids } = query.payload;
+        if (ids?.length === 0)
+            return { rows: [], nextCursor: null };
         // Without a search the first `limit` rows are enough; with one, every
         // candidate must be decrypted before the limit can apply.
         const scanLimit = search === undefined ? limit : SEARCH_SCAN_CAP;
         let users;
         if (isSystemAdmin(query.user)) {
             const db = ctx.systemDb.acknowledgeCrossTenant("SystemAdmin reference labels span every tenant, as user:query:user:list did");
-            users = await selectMany(db, userTable, undefined, {
+            users = await selectMany(db, userTable, ids === undefined ? undefined : { id: ids }, {
                 limit: scanLimit,
                 orderBy: { col: "id", direction: "asc" },
             });
         }
         else {
             const db = ctx.systemDb.assertTenantMatch(query.user.tenantId);
-            const userIds = (await loadMemberUserIds(db, query.user.tenantId)).slice(0, scanLimit);
+            const requestedIds = ids === undefined ? undefined : new Set(ids);
+            const userIds = (await loadMemberUserIds(db, query.user.tenantId))
+                .filter((id) => requestedIds === undefined || requestedIds.has(id))
+                .slice(0, scanLimit);
             users =
                 userIds.length > 0
                     ? await selectMany(db, userTable, { id: [...userIds] }, {

package/dist/tenant/handlers/tenant-directory.query.d.ts

@@ -2,6 +2,7 @@ import * as z from "zod";
 export declare const tenantDirectoryQuery: import("@cosmicdrift/kumiko-framework/engine").PagedQueryHandlerDefinition<"tenantDirectory", z.ZodObject<{
     limit: z.ZodDefault<z.ZodNumber>;
     search: z.ZodOptional<z.ZodString>;
+    ids: z.ZodOptional<z.ZodArray<z.ZodString>>;
 }, z.core.$strip>, {
     id: string;
     label: string;

package/dist/tenant/handlers/tenant-directory.query.js

@@ -21,9 +21,11 @@ export const tenantDirectoryQuery = definePagedQueryHandler({
         limit: z.number().int().min(1).max(MAX_LIST_LIMIT).default(MAX_LIST_LIMIT),
         // Sent by the reference combobox while the user types.
         search: z.string().trim().min(1).optional(),
+        // Resolves exactly these tenants; callers that know their ids must not depend on the cap.
+        ids: z.array(z.string().min(1)).max(MAX_LIST_LIMIT).optional(),
     }),
     access: { roles: access.admin },
-    description: "Lists tenants as id/label pairs for resolving tenant references to display names: the caller's own tenant for an admin, every tenant for a SystemAdmin.",
+    description: "Lists tenants as id/label pairs for resolving tenant references to display names: the caller's own tenant for an admin, every tenant for a SystemAdmin. A search returns the first `limit` matches in tenant-key order (sorted by label afterwards), not the alphabetically best matches.",
     agent: { expose: false },
     handler: async (query, ctx) => {
         if (!ctx.systemDb) {
@@ -31,12 +33,14 @@ export const tenantDirectoryQuery = definePagedQueryHandler({
                 message: "tenant:query:tenant-directory requires ctx.systemDb — is r.systemScope() still set on the tenant feature?",
             });
         }
-        const { limit, search } = query.payload;
+        const { limit, search, ids } = query.payload;
+        if (ids?.length === 0)
+            return { rows: [], nextCursor: null };
         const scanLimit = search === undefined ? limit : SEARCH_SCAN_CAP;
         let tenants;
         if (isSystemAdmin(query.user)) {
             const db = ctx.systemDb.acknowledgeCrossTenant("SystemAdmin reference labels span every tenant, as tenant:query:tenant:list did");
-            tenants = await selectMany(db, tenantTable, undefined, {
+            tenants = await selectMany(db, tenantTable, ids === undefined ? undefined : { id: ids }, {
                 limit: scanLimit,
                 orderBy: [
                     { col: "key", direction: "asc" },
@@ -47,7 +51,7 @@ export const tenantDirectoryQuery = definePagedQueryHandler({
         else {
             const db = ctx.systemDb.assertTenantMatch(query.user.tenantId);
             const row = await fetchOne(db, tenantTable, { id: query.user.tenantId });
-            tenants = row ? [row] : [];
+            tenants = row && (ids === undefined || ids.includes(query.user.tenantId)) ? [row] : [];
         }
         // name is ciphertext at rest, so the SQL page is keyed by the plaintext
         // `key`; label order and search happen in memory after decrypting.

package/dist/tenant-lifecycle/constants.d.ts

@@ -27,3 +27,4 @@ export declare const TenantLifecycleHandlers: {
 export declare const TENANT_DESTRUCTION_STAGES: readonly ["external-resources", "search-indices", "cache", "app-data", "subject-keys", "files", "infra-resources", "tenant-row"];
 export type TenantDestructionStageName = (typeof TENANT_DESTRUCTION_STAGES)[number];
 export declare const DESTRUCTION_STAGE_TICK_BUDGET_MS = 30000;
+export declare const DESTRUCTION_STAGE_MIN_SLICE_MS = 2000;

package/dist/tenant-lifecycle/constants.js

@@ -38,3 +38,7 @@ export const TENANT_DESTRUCTION_STAGES = [
 // The sweep cron fires every minute with concurrency "skip", so a tick must
 // finish well inside that window or the next one is skipped.
 export const DESTRUCTION_STAGE_TICK_BUDGET_MS = 30_000;
+// Lower bound of a tenant's share of the tick budget. Below it a chunking hook
+// without a guaranteed first batch processes nothing, and a no-progress stage
+// counts as a failed attempt, which would abandon the pipeline under load.
+export const DESTRUCTION_STAGE_MIN_SLICE_MS = 2_000;

package/dist/tenant-lifecycle/run-tenant-destroy.js

@@ -3,7 +3,7 @@ import { createSystemUser, } from "@cosmicdrift/kumiko-framework/engine";
 import { append, loadAggregate, VersionConflictError, } from "@cosmicdrift/kumiko-framework/event-store";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import { tenantEntity, tenantTable } from "../tenant/index.js";
-import { DESTRUCTION_STAGE_TICK_BUDGET_MS, TENANT_AGGREGATE_TYPE, TENANT_DESTRUCTION_COMPLETED_EVENT_QN, TENANT_DESTRUCTION_FAILED_EVENT_QN, TENANT_DESTRUCTION_STAGE_ABANDONED_EVENT_SHORT, TENANT_DESTRUCTION_STAGE_FAILED_EVENT_SHORT, TENANT_DESTRUCTION_STAGE_PROGRESSED_EVENT_SHORT, TENANT_DESTRUCTION_STAGE_STARTED_EVENT_SHORT, TENANT_DESTRUCTION_STAGE_SUCCEEDED_EVENT_SHORT, TENANT_DESTRUCTION_STARTED_EVENT_SHORT, } from "./constants.js";
+import { DESTRUCTION_STAGE_MIN_SLICE_MS, DESTRUCTION_STAGE_TICK_BUDGET_MS, TENANT_AGGREGATE_TYPE, TENANT_DESTRUCTION_COMPLETED_EVENT_QN, TENANT_DESTRUCTION_FAILED_EVENT_QN, TENANT_DESTRUCTION_STAGE_ABANDONED_EVENT_SHORT, TENANT_DESTRUCTION_STAGE_FAILED_EVENT_SHORT, TENANT_DESTRUCTION_STAGE_PROGRESSED_EVENT_SHORT, TENANT_DESTRUCTION_STAGE_STARTED_EVENT_SHORT, TENANT_DESTRUCTION_STAGE_SUCCEEDED_EVENT_SHORT, TENANT_DESTRUCTION_STARTED_EVENT_SHORT, } from "./constants.js";
 import { invalidateTenantLifecycleGate, TEARDOWN_GATE_SETTLE_MS } from "./lifecycle-gate.js";
 import { isDestructionPipelineComplete, pickNextStage, } from "./stages.js";
 const tenantCrud = createEventStoreExecutor(tenantTable, tenantEntity, { entityName: "tenant" });
@@ -251,7 +251,7 @@ export async function runTenantDestructionSweep(args) {
     // window and starve the ones behind it. Each slice starts when its tenant
     // starts: anchoring to a shared tick deadline would hand tenants after an
     // overrun a zero slice, and a no-progress stage counts as a failed attempt.
-    const sliceMs = DESTRUCTION_STAGE_TICK_BUDGET_MS / Math.max(1, destroying.length);
+    const sliceMs = Math.max(DESTRUCTION_STAGE_MIN_SLICE_MS, DESTRUCTION_STAGE_TICK_BUDGET_MS / Math.max(1, destroying.length));
     for (const row of destroying) {
         const tenantDeadlineAt = Date.now() + sliceMs;
         try {

package/dist/tier-engine/handlers/set-tenant-tier.write.d.ts

@@ -16,9 +16,8 @@ export declare function createSetTenantTierWrite(opts?: SetTenantTierOptions): i
     tenantId: z.ZodString;
     tier: z.ZodString;
     source: z.ZodDefault<z.ZodEnum<{
-        readonly manual: "manual";
-        readonly billing: "billing";
-        readonly default: "default";
+        billing: "billing";
+        manual: "manual";
     }>>;
 }, z.core.$strip>, {
     tenantId: string;

package/dist/tier-engine/handlers/set-tenant-tier.write.js

@@ -38,7 +38,10 @@ export function createSetTenantTierWrite(opts = {}) {
                 .min(1)
                 .max(50)
                 .refine((t) => !opts.validTiers || opts.validTiers.has(t), { message: "unknown tier" }),
-            source: z.enum(TierAssignmentSources).default(TierAssignmentSources.manual),
+            // `default` is reserved for the signup default tier; the billing sync treats it like `billing`.
+            source: z
+                .enum([TierAssignmentSources.manual, TierAssignmentSources.billing])
+                .default(TierAssignmentSources.manual),
         }),
         access: { roles: ["SystemAdmin"] },
         agent: { risk: "high" },